The upstream release tarballs include the vendored dependencies. In Fedora builds, %goprep will remove them and still use dynamic buildrequires, but RHEL does not package those and needs to use the vendoring.